CompTIA PenTest+ Practice Test

Which attack method exploits semicolon-delimited database connection strings?

1. SQL Injection

2. Connection String Parameter Pollution (CSPP)

3. Cross-Site Scripting (XSS)

4. Command Injection

The correct answer is: Connection String Parameter Pollution (CSPP)

Connection String Parameter Pollution (CSPP) specifically targets the way applications handle database connection strings, exploiting the use of semicolons as delimiters. In typical application scenarios, connection strings are used to configure how the application connects to a database, including parameters like server address, authentication, and options. In CSPP, an attacker inserts additional parameters into a semicolon-delimited connection string, taking advantage of how some applications parse these strings. If the application does not handle these additional parameters correctly, it may lead to unexpected behavior, allow unauthorized access, or enable the attacker to manipulate the database connection in harmful ways. While SQL Injection also deals with databases, it involves injecting malicious SQL code into queries, rather than manipulating the connection string directly. Cross-Site Scripting (XSS) targets web applications by injecting scripts into pages viewed by other users, and Command Injection involves executing arbitrary commands on the server's operating system instead of targeting database connections. Thus, the nature of CSPP makes it distinct from these other attack methods.